Rethinking the optimization objective for transferable adversarial examples from a fuzzy perspective

IF 6 1区 计算机科学 Q1 COMPUTER SCIENCE, ARTIFICIAL INTELLIGENCE
Xiangyuan Yang , Jie Lin , Hanlin Zhang , Peng Zhao
{"title":"Rethinking the optimization objective for transferable adversarial examples from a fuzzy perspective","authors":"Xiangyuan Yang ,&nbsp;Jie Lin ,&nbsp;Hanlin Zhang ,&nbsp;Peng Zhao","doi":"10.1016/j.neunet.2024.107019","DOIUrl":null,"url":null,"abstract":"<div><div>Transferable adversarial examples, which are generated by transfer-based attacks, have strong adaptability for attacking a completely unfamiliar victim model without knowing its architecture, parameters and outputs. While current transfer-based attacks easily defeat surrogate model with minor perturbations, they struggle to transfer these perturbations to unfamiliar victim models. To characterize these untransferable adversarial examples, which consist of natural examples and perturbations, we define the concept of <em>fuzzy domain</em>. Here, the adversarial examples that do not fall inside the fuzzy domain will successfully attack the victim model. To assist the adversarial examples in escaping from the fuzzy domain, we propose a fuzzy optimization-based transferable attack (FOTA) to maximize both the original cross-entropy (CE) loss and the newly proposed membership functions. The proposed membership functions are positively correlated to the probability of falling outside the fuzzy domain. Furthermore, to maximize the transferability of adversarial examples, we present Adaptive FOTA (Ada-FOTA), which dynamically updates the adversarial examples until the membership functions converge, rather than fixing the number of update iterations in advance in the current attacks. When the membership functions converge to 1, the maximum probability that adversarial examples fall outside the fuzzy domain can be achieved. The empirical results on ImageNet dataset show that, for minor perturbations, our FOTA can improve the transferability of adversarial examples by 5.4% on attacking five naturally-trained victim models, and Ada-FOTA can further increase the transferability of adversarial examples by an additional 13.8% in comparison with current transfer-based attacks. Code is available at <span><span>https://github.com/HaloMoto/FOTA</span><svg><path></path></svg></span>.</div></div>","PeriodicalId":49763,"journal":{"name":"Neural Networks","volume":"184 ","pages":"Article 107019"},"PeriodicalIF":6.0000,"publicationDate":"2024-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Neural Networks","FirstCategoryId":"94","ListUrlMain":"https://www.sciencedirect.com/science/article/pii/S0893608024009481","RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q1","JCRName":"COMPUTER SCIENCE, ARTIFICIAL INTELLIGENCE","Score":null,"Total":0}
引用次数: 0

Abstract

Transferable adversarial examples, which are generated by transfer-based attacks, have strong adaptability for attacking a completely unfamiliar victim model without knowing its architecture, parameters and outputs. While current transfer-based attacks easily defeat surrogate model with minor perturbations, they struggle to transfer these perturbations to unfamiliar victim models. To characterize these untransferable adversarial examples, which consist of natural examples and perturbations, we define the concept of fuzzy domain. Here, the adversarial examples that do not fall inside the fuzzy domain will successfully attack the victim model. To assist the adversarial examples in escaping from the fuzzy domain, we propose a fuzzy optimization-based transferable attack (FOTA) to maximize both the original cross-entropy (CE) loss and the newly proposed membership functions. The proposed membership functions are positively correlated to the probability of falling outside the fuzzy domain. Furthermore, to maximize the transferability of adversarial examples, we present Adaptive FOTA (Ada-FOTA), which dynamically updates the adversarial examples until the membership functions converge, rather than fixing the number of update iterations in advance in the current attacks. When the membership functions converge to 1, the maximum probability that adversarial examples fall outside the fuzzy domain can be achieved. The empirical results on ImageNet dataset show that, for minor perturbations, our FOTA can improve the transferability of adversarial examples by 5.4% on attacking five naturally-trained victim models, and Ada-FOTA can further increase the transferability of adversarial examples by an additional 13.8% in comparison with current transfer-based attacks. Code is available at https://github.com/HaloMoto/FOTA.
从模糊视角反思可转移对抗示例的优化目标。
可转移的对抗示例是由基于转移的攻击产生的,对于攻击一个完全不熟悉的受害者模型具有很强的适应性,而不知道其架构、参数和输出。虽然目前基于转移的攻击很容易通过轻微的扰动击败代理模型,但它们很难将这些扰动转移到不熟悉的受害者模型上。为了描述这些由自然例子和扰动组成的不可转移的对抗例子,我们定义了模糊域的概念。在这里,不属于模糊域的对抗性示例将成功攻击受害者模型。为了帮助对抗实例逃离模糊域,我们提出了一种基于模糊优化的可转移攻击(FOTA),以最大化原始交叉熵(CE)损失和新提出的隶属函数。所提出的隶属函数与落在模糊域外的概率正相关。此外,为了最大限度地提高对抗样本的可转移性,我们提出了自适应FOTA (Ada-FOTA),它动态更新对抗样本直到隶属函数收敛,而不是在当前攻击中预先固定更新迭代的次数。当隶属函数收敛于1时,可以达到对抗实例落在模糊域外的最大概率。在ImageNet数据集上的实证结果表明,对于较小的扰动,我们的FOTA可以将攻击5个自然训练的受害者模型的对抗性示例的可转移性提高5.4%,并且与当前基于转移的攻击相比,Ada-FOTA可以进一步将对抗性示例的可转移性提高13.8%。代码可从https://github.com/HaloMoto/FOTA获得。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
Neural Networks
Neural Networks 工程技术-计算机:人工智能
CiteScore
13.90
自引率
7.70%
发文量
425
审稿时长
67 days
期刊介绍: Neural Networks is a platform that aims to foster an international community of scholars and practitioners interested in neural networks, deep learning, and other approaches to artificial intelligence and machine learning. Our journal invites submissions covering various aspects of neural networks research, from computational neuroscience and cognitive modeling to mathematical analyses and engineering applications. By providing a forum for interdisciplinary discussions between biology and technology, we aim to encourage the development of biologically-inspired artificial intelligence.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信